[pve-devel] [PATCH qemu-server] restrict monitor API call to Sys.Modify

[Fabian Grünbichler]

because this allows adding arbitrary devices to VMs (and
other potentially dangerous things)
---
 PVE/API2/Qemu.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index 34a5d5d..e6fbb1b 100644
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -2775,7 +2775,7 @@ __PACKAGE__->register_method({
     proxyto => 'node',
     description => "Execute Qemu monitor commands.",
     permissions => {
-	check => ['perm', '/vms/{vmid}', [ 'VM.Monitor' ]],
+	check => ['perm', '/', [ 'Sys.Modify' ]],
     },
     parameters => {
     	additionalProperties => 0,
-- 
2.1.4